From e1e5803a287eff3ec42ea16dd3685389577a4a42 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Hern=C3=A1ndez=20Bab=C3=B3n?= <juan@joinmastodon.org>
Date: Wed, 26 Aug 2026 18:36:00 +0200
Subject: [PATCH] Fixes GHSA-62j4-hvj7-px3f

---
 app/controllers/admin/base_controller.rb      |  1 +
 .../v1/admin/account_actions_controller.rb    |  1 +
 .../api/v1/admin/accounts_controller.rb       |  1 +
 .../canonical_email_blocks_controller.rb      |  1 +
 .../api/v1/admin/dimensions_controller.rb     |  1 +
 .../api/v1/admin/domain_allows_controller.rb  |  1 +
 .../api/v1/admin/domain_blocks_controller.rb  |  1 +
 .../admin/email_domain_blocks_controller.rb   |  1 +
 .../api/v1/admin/ip_blocks_controller.rb      |  1 +
 .../api/v1/admin/measures_controller.rb       |  1 +
 .../api/v1/admin/reports_controller.rb        |  1 +
 .../api/v1/admin/retention_controller.rb      |  1 +
 .../api/v1/admin/tags_controller.rb           |  2 +
 .../preview_card_providers_controller.rb      |  1 +
 .../api/v1/admin/trends/links_controller.rb   |  1 +
 .../v1/admin/trends/statuses_controller.rb    |  1 +
 .../api/v1/admin/trends/tags_controller.rb    |  1 +
 .../concerns/admin/permissions_concern.rb     | 16 ++++++++
 app/policies/application_policy.rb            |  2 +
 spec/policies/application_policy_spec.rb      | 37 +++++++++++++++++++
 .../api/v1/admin/account_actions_spec.rb      |  4 ++
 spec/requests/api/v1/admin/accounts_spec.rb   |  9 +++++
 .../v1/admin/canonical_email_blocks_spec.rb   |  5 +++
 .../api/v1/admin/domain_allows_spec.rb        |  4 ++
 .../api/v1/admin/domain_blocks_spec.rb        |  5 +++
 .../api/v1/admin/email_domain_blocks_spec.rb  |  4 ++
 spec/requests/api/v1/admin/ip_blocks_spec.rb  |  3 ++
 spec/requests/api/v1/admin/reports_spec.rb    |  6 +++
 spec/requests/api/v1/admin/tags_spec.rb       |  3 ++
 .../api/v1/admin/trends/links/links_spec.rb   |  2 +
 .../links/preview_card_providers_spec.rb      |  2 +
 .../api/v1/admin/trends/statuses_spec.rb      |  2 +
 .../requests/api/v1/admin/trends/tags_spec.rb |  2 +
 spec/support/examples/api.rb                  | 11 ++++++
 34 files changed, 135 insertions(+)
 create mode 100644 app/controllers/concerns/admin/permissions_concern.rb
 create mode 100644 spec/policies/application_policy_spec.rb

diff --git a/app/controllers/admin/base_controller.rb b/app/controllers/admin/base_controller.rb
index 42965696da1..6338c297549 100644
--- a/app/controllers/admin/base_controller.rb
+++ b/app/controllers/admin/base_controller.rb
@@ -4,6 +4,7 @@ module Admin
   class BaseController < ApplicationController
     include Authorization
     include AccountableConcern
+    include Admin::PermissionsConcern
 
     layout 'admin'
 
diff --git a/app/controllers/api/v1/admin/account_actions_controller.rb b/app/controllers/api/v1/admin/account_actions_controller.rb
index 7249797a40b..fd2b91c125f 100644
--- a/app/controllers/api/v1/admin/account_actions_controller.rb
+++ b/app/controllers/api/v1/admin/account_actions_controller.rb
@@ -2,6 +2,7 @@
 
 class Api::V1::Admin::AccountActionsController < Api::BaseController
   include Authorization
+  include Admin::PermissionsConcern
 
   before_action -> { authorize_if_got_token! :'admin:write', :'admin:write:accounts' }
   before_action :set_account
diff --git a/app/controllers/api/v1/admin/accounts_controller.rb b/app/controllers/api/v1/admin/accounts_controller.rb
index ff6f41e01da..cc42db25352 100644
--- a/app/controllers/api/v1/admin/accounts_controller.rb
+++ b/app/controllers/api/v1/admin/accounts_controller.rb
@@ -3,6 +3,7 @@
 class Api::V1::Admin::AccountsController < Api::BaseController
   include Authorization
   include AccountableConcern
+  include Admin::PermissionsConcern
 
   LIMIT = 100
 
diff --git a/app/controllers/api/v1/admin/canonical_email_blocks_controller.rb b/app/controllers/api/v1/admin/canonical_email_blocks_controller.rb
index c144a9e0f93..12c2603087b 100644
--- a/app/controllers/api/v1/admin/canonical_email_blocks_controller.rb
+++ b/app/controllers/api/v1/admin/canonical_email_blocks_controller.rb
@@ -3,6 +3,7 @@
 class Api::V1::Admin::CanonicalEmailBlocksController < Api::BaseController
   include Authorization
   include AccountableConcern
+  include Admin::PermissionsConcern
 
   LIMIT = 100
 
diff --git a/app/controllers/api/v1/admin/dimensions_controller.rb b/app/controllers/api/v1/admin/dimensions_controller.rb
index 4a72ad08be7..1f8dc9f2aa1 100644
--- a/app/controllers/api/v1/admin/dimensions_controller.rb
+++ b/app/controllers/api/v1/admin/dimensions_controller.rb
@@ -2,6 +2,7 @@
 
 class Api::V1::Admin::DimensionsController < Api::BaseController
   include Authorization
+  include Admin::PermissionsConcern
 
   before_action -> { authorize_if_got_token! :'admin:read' }
   before_action :set_dimensions
diff --git a/app/controllers/api/v1/admin/domain_allows_controller.rb b/app/controllers/api/v1/admin/domain_allows_controller.rb
index 24f68aa1bd8..e3f5ddb7ab8 100644
--- a/app/controllers/api/v1/admin/domain_allows_controller.rb
+++ b/app/controllers/api/v1/admin/domain_allows_controller.rb
@@ -3,6 +3,7 @@
 class Api::V1::Admin::DomainAllowsController < Api::BaseController
   include Authorization
   include AccountableConcern
+  include Admin::PermissionsConcern
 
   LIMIT = 100
   MAX_LIMIT = 500
diff --git a/app/controllers/api/v1/admin/domain_blocks_controller.rb b/app/controllers/api/v1/admin/domain_blocks_controller.rb
index b44ae2ae2a2..90dec85c15c 100644
--- a/app/controllers/api/v1/admin/domain_blocks_controller.rb
+++ b/app/controllers/api/v1/admin/domain_blocks_controller.rb
@@ -3,6 +3,7 @@
 class Api::V1::Admin::DomainBlocksController < Api::BaseController
   include Authorization
   include AccountableConcern
+  include Admin::PermissionsConcern
 
   LIMIT = 100
   MAX_LIMIT = 500
diff --git a/app/controllers/api/v1/admin/email_domain_blocks_controller.rb b/app/controllers/api/v1/admin/email_domain_blocks_controller.rb
index e7bd804e366..571d5f67252 100644
--- a/app/controllers/api/v1/admin/email_domain_blocks_controller.rb
+++ b/app/controllers/api/v1/admin/email_domain_blocks_controller.rb
@@ -3,6 +3,7 @@
 class Api::V1::Admin::EmailDomainBlocksController < Api::BaseController
   include Authorization
   include AccountableConcern
+  include Admin::PermissionsConcern
 
   LIMIT = 100
 
diff --git a/app/controllers/api/v1/admin/ip_blocks_controller.rb b/app/controllers/api/v1/admin/ip_blocks_controller.rb
index e132a3a87d6..e3671ea494e 100644
--- a/app/controllers/api/v1/admin/ip_blocks_controller.rb
+++ b/app/controllers/api/v1/admin/ip_blocks_controller.rb
@@ -3,6 +3,7 @@
 class Api::V1::Admin::IpBlocksController < Api::BaseController
   include Authorization
   include AccountableConcern
+  include Admin::PermissionsConcern
 
   LIMIT = 100
 
diff --git a/app/controllers/api/v1/admin/measures_controller.rb b/app/controllers/api/v1/admin/measures_controller.rb
index e90e50f999b..8518cd5e414 100644
--- a/app/controllers/api/v1/admin/measures_controller.rb
+++ b/app/controllers/api/v1/admin/measures_controller.rb
@@ -2,6 +2,7 @@
 
 class Api::V1::Admin::MeasuresController < Api::BaseController
   include Authorization
+  include Admin::PermissionsConcern
 
   before_action -> { authorize_if_got_token! :'admin:read' }
   before_action :set_measures
diff --git a/app/controllers/api/v1/admin/reports_controller.rb b/app/controllers/api/v1/admin/reports_controller.rb
index 9b5beeab67e..4f18222b1db 100644
--- a/app/controllers/api/v1/admin/reports_controller.rb
+++ b/app/controllers/api/v1/admin/reports_controller.rb
@@ -3,6 +3,7 @@
 class Api::V1::Admin::ReportsController < Api::BaseController
   include Authorization
   include AccountableConcern
+  include Admin::PermissionsConcern
 
   LIMIT = 100
 
diff --git a/app/controllers/api/v1/admin/retention_controller.rb b/app/controllers/api/v1/admin/retention_controller.rb
index 41f1be7edbe..4acfbb6da93 100644
--- a/app/controllers/api/v1/admin/retention_controller.rb
+++ b/app/controllers/api/v1/admin/retention_controller.rb
@@ -2,6 +2,7 @@
 
 class Api::V1::Admin::RetentionController < Api::BaseController
   include Authorization
+  include Admin::PermissionsConcern
 
   before_action -> { authorize_if_got_token! :'admin:read' }
   before_action :set_retention
diff --git a/app/controllers/api/v1/admin/tags_controller.rb b/app/controllers/api/v1/admin/tags_controller.rb
index 283383acb4a..c57c771864b 100644
--- a/app/controllers/api/v1/admin/tags_controller.rb
+++ b/app/controllers/api/v1/admin/tags_controller.rb
@@ -2,6 +2,8 @@
 
 class Api::V1::Admin::TagsController < Api::BaseController
   include Authorization
+  include Admin::PermissionsConcern
+
   before_action -> { authorize_if_got_token! :'admin:read' }, only: [:index, :show]
   before_action -> { authorize_if_got_token! :'admin:write' }, only: :update
 
diff --git a/app/controllers/api/v1/admin/trends/links/preview_card_providers_controller.rb b/app/controllers/api/v1/admin/trends/links/preview_card_providers_controller.rb
index 2b0f39b98f9..65e96924aa6 100644
--- a/app/controllers/api/v1/admin/trends/links/preview_card_providers_controller.rb
+++ b/app/controllers/api/v1/admin/trends/links/preview_card_providers_controller.rb
@@ -2,6 +2,7 @@
 
 class Api::V1::Admin::Trends::Links::PreviewCardProvidersController < Api::BaseController
   include Authorization
+  include Admin::PermissionsConcern
 
   LIMIT = 100
 
diff --git a/app/controllers/api/v1/admin/trends/links_controller.rb b/app/controllers/api/v1/admin/trends/links_controller.rb
index 7f4ca482882..13d7ae70c0c 100644
--- a/app/controllers/api/v1/admin/trends/links_controller.rb
+++ b/app/controllers/api/v1/admin/trends/links_controller.rb
@@ -2,6 +2,7 @@
 
 class Api::V1::Admin::Trends::LinksController < Api::V1::Trends::LinksController
   include Authorization
+  include Admin::PermissionsConcern
 
   before_action -> { authorize_if_got_token! :'admin:read' }, only: :index
   before_action -> { authorize_if_got_token! :'admin:write' }, except: :index
diff --git a/app/controllers/api/v1/admin/trends/statuses_controller.rb b/app/controllers/api/v1/admin/trends/statuses_controller.rb
index 34b6580df15..dfb1d70a2aa 100644
--- a/app/controllers/api/v1/admin/trends/statuses_controller.rb
+++ b/app/controllers/api/v1/admin/trends/statuses_controller.rb
@@ -2,6 +2,7 @@
 
 class Api::V1::Admin::Trends::StatusesController < Api::V1::Trends::StatusesController
   include Authorization
+  include Admin::PermissionsConcern
 
   before_action -> { authorize_if_got_token! :'admin:read' }, only: :index
   before_action -> { authorize_if_got_token! :'admin:write' }, except: :index
diff --git a/app/controllers/api/v1/admin/trends/tags_controller.rb b/app/controllers/api/v1/admin/trends/tags_controller.rb
index 2eeea95225c..d368ff8eaab 100644
--- a/app/controllers/api/v1/admin/trends/tags_controller.rb
+++ b/app/controllers/api/v1/admin/trends/tags_controller.rb
@@ -2,6 +2,7 @@
 
 class Api::V1::Admin::Trends::TagsController < Api::V1::Trends::TagsController
   include Authorization
+  include Admin::PermissionsConcern
 
   before_action -> { authorize_if_got_token! :'admin:read' }, only: :index
   before_action -> { authorize_if_got_token! :'admin:write' }, except: :index
diff --git a/app/controllers/concerns/admin/permissions_concern.rb b/app/controllers/concerns/admin/permissions_concern.rb
new file mode 100644
index 00000000000..a38156619e8
--- /dev/null
+++ b/app/controllers/concerns/admin/permissions_concern.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Admin::PermissionsConcern
+  extend ActiveSupport::Concern
+
+  included do
+    before_action :require_moderator_or_admin_permissions
+  end
+
+  private
+
+  def require_moderator_or_admin_permissions
+    # not using #authorize here, so #verify_authorized still makes sure more fine-grained rules are enforced down the line
+    forbidden unless Admin::BasePolicy.new(current_account, :base).access?
+  end
+end
diff --git a/app/policies/application_policy.rb b/app/policies/application_policy.rb
index 163b81e9e65..4be443bcd78 100644
--- a/app/policies/application_policy.rb
+++ b/app/policies/application_policy.rb
@@ -19,6 +19,8 @@ class ApplicationPolicy
   end
 
   def role
+    return UserRole.nobody if current_user&.disabled?
+
     current_user&.role || UserRole.nobody
   end
 end
diff --git a/spec/policies/application_policy_spec.rb b/spec/policies/application_policy_spec.rb
new file mode 100644
index 00000000000..265be521771
--- /dev/null
+++ b/spec/policies/application_policy_spec.rb
@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe ApplicationPolicy do
+  subject do
+    Class.new(described_class) do
+      def spec?
+        role.can?(:manage_users)
+      end
+    end
+  end
+
+  let(:admin)   { Fabricate(:admin_user).account }
+  let(:john)    { Fabricate(:account) }
+  let(:alice)   { Fabricate(:admin_user, disabled: true).account }
+
+  permissions :spec? do
+    context 'when staff' do
+      it 'permits' do
+        expect(subject).to permit(admin)
+      end
+    end
+
+    context 'when not staff' do
+      it 'denies' do
+        expect(subject).to_not permit(john)
+      end
+    end
+
+    context 'when staff but disabled' do
+      it 'denies' do
+        expect(subject).to_not permit(alice)
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/v1/admin/account_actions_spec.rb b/spec/requests/api/v1/admin/account_actions_spec.rb
index 4884dba9c79..5e1b77a4ad8 100644
--- a/spec/requests/api/v1/admin/account_actions_spec.rb
+++ b/spec/requests/api/v1/admin/account_actions_spec.rb
@@ -55,6 +55,7 @@ RSpec.describe 'Account actions' do
 
       it_behaves_like 'forbidden for wrong scope', 'admin:read admin:read:accounts'
       it_behaves_like 'forbidden for wrong role', ''
+      it_behaves_like 'forbidden for disabled user'
       it_behaves_like 'a successful notification delivery'
       it_behaves_like 'a successful logged action', :disable, :user
 
@@ -71,6 +72,7 @@ RSpec.describe 'Account actions' do
 
       it_behaves_like 'forbidden for wrong scope', 'admin:read admin:read:accounts'
       it_behaves_like 'forbidden for wrong role', ''
+      it_behaves_like 'forbidden for disabled user'
       it_behaves_like 'a successful notification delivery'
       it_behaves_like 'a successful logged action', :sensitive, :account
 
@@ -87,6 +89,7 @@ RSpec.describe 'Account actions' do
 
       it_behaves_like 'forbidden for wrong scope', 'admin:read admin:read:accounts'
       it_behaves_like 'forbidden for wrong role', ''
+      it_behaves_like 'forbidden for disabled user'
       it_behaves_like 'a successful notification delivery'
       it_behaves_like 'a successful logged action', :silence, :account
 
@@ -103,6 +106,7 @@ RSpec.describe 'Account actions' do
 
       it_behaves_like 'forbidden for wrong scope', 'admin:read admin:read:accounts'
       it_behaves_like 'forbidden for wrong role', ''
+      it_behaves_like 'forbidden for disabled user'
       it_behaves_like 'a successful notification delivery'
       it_behaves_like 'a successful logged action', :suspend, :account
 
diff --git a/spec/requests/api/v1/admin/accounts_spec.rb b/spec/requests/api/v1/admin/accounts_spec.rb
index 6a681f9c5e5..f9aee368f98 100644
--- a/spec/requests/api/v1/admin/accounts_spec.rb
+++ b/spec/requests/api/v1/admin/accounts_spec.rb
@@ -34,6 +34,7 @@ RSpec.describe 'Accounts' do
 
     it_behaves_like 'forbidden for wrong scope', 'read read:accounts admin:write admin:write:accounts'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     context 'when requesting active local staff accounts' do
       let(:expected_results) { [admin_account] }
@@ -111,6 +112,7 @@ RSpec.describe 'Accounts' do
 
     it_behaves_like 'forbidden for wrong scope', 'read read:accounts admin:write admin:write:accounts'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns the requested account successfully', :aggregate_failures do
       subject
@@ -148,6 +150,7 @@ RSpec.describe 'Accounts' do
 
       it_behaves_like 'forbidden for wrong scope', 'write write:accounts read admin:read'
       it_behaves_like 'forbidden for wrong role', ''
+      it_behaves_like 'forbidden for disabled user'
 
       it 'approves the user successfully', :aggregate_failures do
         subject
@@ -206,6 +209,7 @@ RSpec.describe 'Accounts' do
 
       it_behaves_like 'forbidden for wrong scope', 'write write:accounts read admin:read'
       it_behaves_like 'forbidden for wrong role', ''
+      it_behaves_like 'forbidden for disabled user'
 
       it 'removes the user successfully and logs action', :aggregate_failures do
         subject
@@ -259,6 +263,7 @@ RSpec.describe 'Accounts' do
 
     it_behaves_like 'forbidden for wrong scope', 'write write:accounts read admin:read'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'enables the user successfully', :aggregate_failures do
       subject
@@ -294,6 +299,7 @@ RSpec.describe 'Accounts' do
 
       it_behaves_like 'forbidden for wrong scope', 'write write:accounts read admin:read'
       it_behaves_like 'forbidden for wrong role', ''
+      it_behaves_like 'forbidden for disabled user'
 
       it 'unsuspends the account successfully', :aggregate_failures do
         subject
@@ -339,6 +345,7 @@ RSpec.describe 'Accounts' do
 
     it_behaves_like 'forbidden for wrong scope', 'write write:accounts read admin:read'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'unsensitizes the account successfully', :aggregate_failures do
       subject
@@ -373,6 +380,7 @@ RSpec.describe 'Accounts' do
 
     it_behaves_like 'forbidden for wrong scope', 'write write:accounts read admin:read'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'unsilences the account successfully', :aggregate_failures do
       subject
@@ -408,6 +416,7 @@ RSpec.describe 'Accounts' do
 
       it_behaves_like 'forbidden for wrong scope', 'write write:accounts read admin:read'
       it_behaves_like 'forbidden for wrong role', ''
+      it_behaves_like 'forbidden for disabled user'
 
       it 'deletes the account successfully', :aggregate_failures do
         allow(Admin::AccountDeletionWorker).to receive(:perform_async)
diff --git a/spec/requests/api/v1/admin/canonical_email_blocks_spec.rb b/spec/requests/api/v1/admin/canonical_email_blocks_spec.rb
index 25af0a26afe..ff70e3b89dc 100644
--- a/spec/requests/api/v1/admin/canonical_email_blocks_spec.rb
+++ b/spec/requests/api/v1/admin/canonical_email_blocks_spec.rb
@@ -19,6 +19,7 @@ RSpec.describe 'Canonical Email Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'read:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     context 'when there is no canonical email block' do
       it 'returns an empty list' do
@@ -94,6 +95,7 @@ RSpec.describe 'Canonical Email Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'read:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     context 'when the requested canonical email block exists' do
       it 'returns the requested canonical email block data correctly', :aggregate_failures do
@@ -131,6 +133,7 @@ RSpec.describe 'Canonical Email Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'read:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     context 'when the required email param is not provided' do
       let(:params) { {} }
@@ -182,6 +185,7 @@ RSpec.describe 'Canonical Email Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'read:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns the canonical_email_hash correctly', :aggregate_failures do
       subject
@@ -256,6 +260,7 @@ RSpec.describe 'Canonical Email Blocks' do
 
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     it 'deletes the canonical email block', :aggregate_failures do
       subject
diff --git a/spec/requests/api/v1/admin/domain_allows_spec.rb b/spec/requests/api/v1/admin/domain_allows_spec.rb
index fba1eb15d37..72edd4bccdb 100644
--- a/spec/requests/api/v1/admin/domain_allows_spec.rb
+++ b/spec/requests/api/v1/admin/domain_allows_spec.rb
@@ -19,6 +19,7 @@ RSpec.describe 'Domain Allows' do
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     context 'when there is no allowed domains' do
       it 'returns an empty body' do
@@ -77,6 +78,7 @@ RSpec.describe 'Domain Allows' do
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns the expected allowed domain name', :aggregate_failures do
       subject
@@ -108,6 +110,7 @@ RSpec.describe 'Domain Allows' do
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     context 'with a valid domain name' do
       it 'returns the expected domain name', :aggregate_failures do
@@ -168,6 +171,7 @@ RSpec.describe 'Domain Allows' do
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     it 'deletes the allowed domain', :aggregate_failures do
       subject
diff --git a/spec/requests/api/v1/admin/domain_blocks_spec.rb b/spec/requests/api/v1/admin/domain_blocks_spec.rb
index 0b01d04f9a0..3a6fcda6823 100644
--- a/spec/requests/api/v1/admin/domain_blocks_spec.rb
+++ b/spec/requests/api/v1/admin/domain_blocks_spec.rb
@@ -19,6 +19,7 @@ RSpec.describe 'Domain Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     context 'when there are no domain blocks' do
       it 'returns an empty list' do
@@ -93,6 +94,7 @@ RSpec.describe 'Domain Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns the expected domain block content', :aggregate_failures do
       subject
@@ -135,6 +137,7 @@ RSpec.describe 'Domain Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     it 'creates a domain block with the expected domain name and severity', :aggregate_failures do
       subject
@@ -243,6 +246,7 @@ RSpec.describe 'Domain Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns the updated domain block', :aggregate_failures do
       subject
@@ -285,6 +289,7 @@ RSpec.describe 'Domain Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     it 'deletes the domain block', :aggregate_failures do
       subject
diff --git a/spec/requests/api/v1/admin/email_domain_blocks_spec.rb b/spec/requests/api/v1/admin/email_domain_blocks_spec.rb
index 2788a45a4a2..18fec0cfaed 100644
--- a/spec/requests/api/v1/admin/email_domain_blocks_spec.rb
+++ b/spec/requests/api/v1/admin/email_domain_blocks_spec.rb
@@ -20,6 +20,7 @@ RSpec.describe 'Email Domain Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'read:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     context 'when there is no email domain block' do
       it 'returns an empty list' do
@@ -95,6 +96,7 @@ RSpec.describe 'Email Domain Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'read:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     context 'when email domain block exists' do
       it 'returns the correct blocked domain', :aggregate_failures do
@@ -128,6 +130,7 @@ RSpec.describe 'Email Domain Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'read:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns the correct blocked email domain', :aggregate_failures do
       subject
@@ -187,6 +190,7 @@ RSpec.describe 'Email Domain Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'read:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     it 'deletes email domain block', :aggregate_failures do
       subject
diff --git a/spec/requests/api/v1/admin/ip_blocks_spec.rb b/spec/requests/api/v1/admin/ip_blocks_spec.rb
index 59ef8d29665..0a4f670b0c6 100644
--- a/spec/requests/api/v1/admin/ip_blocks_spec.rb
+++ b/spec/requests/api/v1/admin/ip_blocks_spec.rb
@@ -19,6 +19,7 @@ RSpec.describe 'IP Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'admin:write:ip_blocks'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     context 'when there is no ip block' do
       it 'returns an empty body' do
@@ -87,6 +88,7 @@ RSpec.describe 'IP Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'admin:write:ip_blocks'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns the correct ip block', :aggregate_failures do
       subject
@@ -123,6 +125,7 @@ RSpec.describe 'IP Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'admin:read:ip_blocks'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns the correct ip block', :aggregate_failures do
       subject
diff --git a/spec/requests/api/v1/admin/reports_spec.rb b/spec/requests/api/v1/admin/reports_spec.rb
index 987f0eda7fb..67c94e56ab9 100644
--- a/spec/requests/api/v1/admin/reports_spec.rb
+++ b/spec/requests/api/v1/admin/reports_spec.rb
@@ -18,6 +18,7 @@ RSpec.describe 'Reports' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     context 'when there are no reports' do
       it 'returns an empty list' do
@@ -125,6 +126,7 @@ RSpec.describe 'Reports' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns the requested report content', :aggregate_failures do
       subject
@@ -192,6 +194,7 @@ RSpec.describe 'Reports' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'marks report as resolved', :aggregate_failures do
       expect { subject }
@@ -212,6 +215,7 @@ RSpec.describe 'Reports' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'marks report as unresolved', :aggregate_failures do
       expect { subject }
@@ -232,6 +236,7 @@ RSpec.describe 'Reports' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'assigns report to the requesting user', :aggregate_failures do
       expect { subject }
@@ -252,6 +257,7 @@ RSpec.describe 'Reports' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'unassigns report from assignee', :aggregate_failures do
       expect { subject }
diff --git a/spec/requests/api/v1/admin/tags_spec.rb b/spec/requests/api/v1/admin/tags_spec.rb
index 3a57432af78..9bf42eaf722 100644
--- a/spec/requests/api/v1/admin/tags_spec.rb
+++ b/spec/requests/api/v1/admin/tags_spec.rb
@@ -19,6 +19,7 @@ RSpec.describe 'Tags' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     context 'when there are no tags' do
       it 'returns an empty list' do
@@ -76,6 +77,7 @@ RSpec.describe 'Tags' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns http success and expected tag content' do
       subject
@@ -113,6 +115,7 @@ RSpec.describe 'Tags' do
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong scope', 'admin:read'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns http success and updates tag' do
       subject
diff --git a/spec/requests/api/v1/admin/trends/links/links_spec.rb b/spec/requests/api/v1/admin/trends/links/links_spec.rb
index 51e800734aa..74736771bb9 100644
--- a/spec/requests/api/v1/admin/trends/links/links_spec.rb
+++ b/spec/requests/api/v1/admin/trends/links/links_spec.rb
@@ -32,6 +32,7 @@ RSpec.describe 'Links' do
 
     it_behaves_like 'forbidden for wrong scope', 'read write'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns http success' do
       expect { subject }
@@ -91,6 +92,7 @@ RSpec.describe 'Links' do
 
     it_behaves_like 'forbidden for wrong scope', 'read write'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns http success' do
       expect { subject }
diff --git a/spec/requests/api/v1/admin/trends/links/preview_card_providers_spec.rb b/spec/requests/api/v1/admin/trends/links/preview_card_providers_spec.rb
index d46d0ff5555..c3b84152337 100644
--- a/spec/requests/api/v1/admin/trends/links/preview_card_providers_spec.rb
+++ b/spec/requests/api/v1/admin/trends/links/preview_card_providers_spec.rb
@@ -28,6 +28,7 @@ RSpec.describe 'API V1 Admin Trends Links Preview Card Providers' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns http success' do
       expect(response).to have_http_status(200)
@@ -43,6 +44,7 @@ RSpec.describe 'API V1 Admin Trends Links Preview Card Providers' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns http success' do
       expect(response).to have_http_status(200)
diff --git a/spec/requests/api/v1/admin/trends/statuses_spec.rb b/spec/requests/api/v1/admin/trends/statuses_spec.rb
index c63d8d925c7..7c3b35d8c75 100644
--- a/spec/requests/api/v1/admin/trends/statuses_spec.rb
+++ b/spec/requests/api/v1/admin/trends/statuses_spec.rb
@@ -28,6 +28,7 @@ RSpec.describe 'API V1 Admin Trends Statuses' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns http success' do
       expect(response).to have_http_status(200)
@@ -43,6 +44,7 @@ RSpec.describe 'API V1 Admin Trends Statuses' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns http success' do
       expect(response).to have_http_status(200)
diff --git a/spec/requests/api/v1/admin/trends/tags_spec.rb b/spec/requests/api/v1/admin/trends/tags_spec.rb
index 433cc6c5a6e..9fd2c614ba4 100644
--- a/spec/requests/api/v1/admin/trends/tags_spec.rb
+++ b/spec/requests/api/v1/admin/trends/tags_spec.rb
@@ -28,6 +28,7 @@ RSpec.describe 'API V1 Admin Trends Tags' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns http success' do
       expect(response).to have_http_status(200)
@@ -43,6 +44,7 @@ RSpec.describe 'API V1 Admin Trends Tags' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns http success' do
       expect(response).to have_http_status(200)
diff --git a/spec/support/examples/api.rb b/spec/support/examples/api.rb
index ddc61fcbe08..ea63af45ba8 100644
--- a/spec/support/examples/api.rb
+++ b/spec/support/examples/api.rb
@@ -21,3 +21,14 @@ RSpec.shared_examples 'forbidden for wrong role' do |wrong_role|
     expect(response).to have_http_status(403)
   end
 end
+
+RSpec.shared_examples 'forbidden for disabled user' do
+  let(:user) { Fabricate(:admin_user, disabled: true) }
+
+  it 'returns http forbidden' do
+    # Some examples have a subject which needs to be called to make a request
+    subject if request.nil?
+
+    expect(response).to have_http_status(403)
+  end
+end